# \_grokparsefailure on kibana for record through logstash

**URL:** <https://discuss.elastic.co/t/grokparsefailure-on-kibana-for-record-through-logstash/287073>\
**Category:** Logstash\
**Created:** [October 19, 2021, 10:19am UTC](https://discuss.elastic.co/t/grokparsefailure-on-kibana-for-record-through-logstash/287073 "2021-10-19T10:19:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kish2010](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kish2010/32/96066_2.png) [@kish2010](https://discuss.elastic.co/u/kish2010)\
**Post date:** [October 19, 2021, 10:19am UTC](https://discuss.elastic.co/t/grokparsefailure-on-kibana-for-record-through-logstash/287073/1 "2021-10-19T10:19:57Z")

</div>

Hi All,  
I have created grok pattern and tested with log on grokdebugger but still it is failing with grokparsefailure error on kibana.

PFB Config file:-  
input {  
file {  
path =\> "/tmp/test.csv"  
}  
}  
filter {  
grok {  
match =\> { "message" =\> ["(?._)^|^(?\<log\_type\>._)^|^(?\<record\_UUID\>._)^|^(?._)^|^(?._)^|^(?._)^|^(?._)^|^(?._)^|^(?\<event\_ts\>._)^|^(?._)^|^(?\<time\_taken\_in\_ms\>._)^|^(?._)^|^(?\<as\_snap\>._)^|^(?._)"]  
}  
}  
mutate  
{  
remove\_field =\> ["message"]  
}  
output {  
Elasticsearch {  
hosts =\> ["[http://x.x.x.x:9200](http://x.x.x.x:9200)"]  
index =\> "test"  
}  
}

---

<div class="post-metadata">

**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Post date:** [October 19, 2021, 12:12pm UTC](https://discuss.elastic.co/t/grokparsefailure-on-kibana-for-record-through-logstash/287073/2 "2021-10-19T12:12:36Z")

</div>

Hi,

Can you show the log sample ?

And what message field to you obtain in elastic ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 16, 2021, 12:13pm UTC](https://discuss.elastic.co/t/grokparsefailure-on-kibana-for-record-through-logstash/287073/3 "2021-11-16T12:13:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.